This commit moves the whole customer portal to the portal module.
It now completely uses portal and http_routing features and is not
dependent on website anymore.
An override of web controller is added in portal in order to redirect
portal users to /my instead of /web. That way once having the customer
portal installed all share users are correctly redirected to their
account.
All modules defining customer portal templates and controllers are
updated accordingly.
We make the breadcrumbs of the portal uniform and remove them when we
access the document with an access token without being logged in
(for sales orders).
Online quote now uses JS code from payment module in order to make online
payments. Front-end template is updated to use o_payment_acquirer_button
generic class for payments and data is added to be managed by payment.js.
This allows to remove some strange code parsing the url to find the order
ID and token instead of using rendered values.
A payment controller is removed because it was only a shortcut to another
one. In transaction controller token parameter is renamed to access_token
to avoid confusion with payment token and match the payment and website
sale naming.
Online Quote controller now uses tools method from sale_payment module
like website_sale. This way it is now standardized and moved out of
controllers that should not perform so much model-level computation.
Move sale and payment bridge code into its own module. This commit mainly
moves (and reorganizes without changes) code from website_sale related
to payment and SO confirmation.
Only change is that payment_acquirer_id field on sale order is now a
related on transaction.acquirer_id . Indeed in website_sale and
website_quote both values were written but only managing transactions
and getting its acquirer is more efficient and ensure values are coherent.
JS part controlling payment form management is moved directly into
payment to reuse later on in future commits. Probably.
In Python 3:
* various builtins and dict methods were changed to return
view/iterable objects rather than lists
* and the separate Python 2 view/iterable builtins and methods were
removed altogether
This is problematic when using these items as list (which the happens
repeatedly in Odoo), but more viciously when iterating *multiple times*
over them (which also happens, which I've messed up multiple times while
writing this, and which is a pain to debug even when you've just created
the issue).
Convert all code using these to semantics-matching cross-version
helper functions to get the LCD behaviour between P2 and P3, and
forbid the builtins via lint.
issue #8530
Portal has access (read only) to partner, pricelist,
taxes, ... These access were given to display informations
on portal pages. Since, these are not very secure, we
remove the access right.
Some modifications are required to make the portal work again :
- 'sudo' business document before rendering templates. ir.rule
are still apply to filter the documents do display.
For instance, SO total amount is computed using account.tax.
- a related field has been added on SO line to allow portal user
to see the image of the ordered product (on SO frontend view)
- a new controller is created to display invoice PDF (as 'sudo'),
since the rendering of this document required read access to
taxes, payment terms, ...
Currently when the salesman clicks on 'Preview' button of quotation it
is set as 'Viewed by Customer'. This commit improves this behavior by
ensuring it is triggered only by shared users.
callback_eval is currently a code string that is evaluated directly
at payment confirmation. This commit changes it to have parameters
on the record and method to call on it. Moreover a hash done once at
transaction creation ensure that a modified transaction does not allow
to execute code on other records.
A side effect of commit b9d1239eff if that the method `sale_get_order`,
which is used to retrieve the SO, will also update information on this
SO (change partner, change pricelist...). We therefore need another way
to retrieve the SO.
opw-692919
When a quotation is opened from the frontend, set the SO id in the
request. This is necessary in the following use case:
- Receive a website quote
- Pay thanks to Stripe
After commit da82a6b705, we call the route
`/shop/payment/transaction/` manually. However, this route expects to
retrieve the SO id thanks to a call to `sale_get_order`. Since we are
not going through the webshop and the user might not be connected, the
method is unable to retrieve the SO id.
opw-692341
Somehow in the migration to the new api, it was decided that the
acquirers would be browser as sudo only for token access. This caused
portal users to have a crash when trying to view their quotation since
some fields from acquirers are set the specific groups for security.
This commit reintroduces the old behaviour, which was to browse as
SUPERUSER in all cases for the rendering of the buttons.
When the route /quote/<order_id>
is accessed without token
e.g. through the `View sales Order` button
in the headers of thread mails
the user must be redirected to the login screen
if he's not signed in.
In other words, you must be signed in to access
this route without token.
opw-687931
Currently some customers receive the automatic notification 'Quotation
viewed by customer'. This should not be the case as this notifciation
is purely internal and should only be sent to the quote responsible.
Notification is now a note with the responsible being directly in the
recipients.
Conflicts:
addons/website_quote/controllers/main.py
Backport of 14f07cb96f
opw-687957
Currently some customers receive the automatic notification 'Quotation
viewed by customer'. This should not be the case as this notifciation
is purely internal and should only be sent to the quote responsible.
Notification is now a note with the responsible being directly in the
recipients.
* get_pdf function expects a list of ids since the removal of old api in
this commit: rev 47c67b640b
There were still some wrong calls.
* while get_action can receive ids and recordsets, get_html and get_pdf
are internal methods and still work with list of ids
* Remove dead code
* Clean variable assignation to a record set and use a dedicated variable to
hold the result instead of setting a property on records
Since saas-3, website controllers use `request.website.render`
to render the template of a web page. This was kept for retro
compatibility. It's time to stop using deprecated stuff.
Same for `_render` method on website.
'json' route don't use `request.render` since
`JsonRequest` has no `render` method.
Introduces two new options:
- confirm_so: to confirm the sale order on acquirer confirmation
- generate_and_pay_invoice: confirm_so + generation of invoice and
payment registration
The transaction `type` of an order can depend according
to the order.
For instance, if the order leads to recurring payments,
the transaction type became `form_save`
instead of `form`.
This new method allow to easily override this `type` value
for other modules, so the entire button
rendering code does not have to be
copy/pasted.
Since aae5647988,
the payment transaction ID is set in the session.
Unlike ecommerce carts, this is possible to open multiple
quotations at the same time
(one browser tab on SO001, another one on SO002),
and therefore to pay multiple quotes at the same time.
This revision makes sure to get from the session the transaction
of the right quote.
That way, the message "Your payment has been received, thank you for your trust.",
is not displayed when opening a new quote when another one was paid
just before.
Before this revision,
when a user tried to pay his cart with a first acquirer
e.g. Ogone
then came back to the shop (using the browser back button)
then chose another acquirer
e.g. Paypal
a new transaction is created, due to the change of acquirer
(following revision cb9d798)
and therefore, the transaction has a new reference compared
to the last payment transaction attempt (e.g. the ogone one)
but, the old reference is still referenced within
the `Pay now` form values, because the page wasn't re-rendered,
because the user pressed the browser back button, and this
doesn't refresh/re-render the page, and, therefore,
the old reference was still referenced within the `Pay Now`
form values.
Therefore, the wrong reference was sent to the acquirer
(e.g. paypal) and this prevented the payment validation
at the payment feedback, as the new reference was expected
in the feedback information, while we receive the older one.
This revision makes sure to always re-render the `Pay now`
form, so the transaction reference, as well as the other
possible changes in the values, are correctly set,
before sending the information to the acquirer.
When configuring the payment acquirer with the confirmation
`at_pay_now`, meaning the sale order has to be
confirmed when clicking on the "Pay now" button, instead
of waiting for the payment confirmation,
the confirmation email wasn't not sent.
opw-665697
This revision is related to 7be2403cf5
The payment acquirers must be fetched if the quote
needs a payment.
Besides, as explained in the above revision, the state
`manual` no longer exists sales orders, and therefore
this must no longer be used to determine if a quote
needs a payment or not.
opw-660575
Before this revision, the button "Pay now" on the quotation
in the frond-end was display only if the sale order
was in the state `manual` and that there was not
yet any payment transaction.
The thing is, since the release of 9.0,
the `manual`state no longer exists in `sale.order`,
and the pay now button was therefore never displayed.
From this revision, the condition to display the button
is based on the `invoice_status`, which need to be `to_invoice`,
meaning there is something to pay:
- The sale.order needs to be in states `sale` or `done`
- At least one line has to be invoiced:
- If the product has the `invoice_policy` set to `order`
- or if the product has the 'invoice_policy` set to `delivery`,
and at least one quantity has been delivered.
opw-659931
Commit 7636b51 modifies the route from JSON to HTTP by mistake. Indeed,
the route /quote/accept is called from an ajax.jsonRpc request, not from
the `method="POST" t-attf-action="/quote/accept` which can be found in
website_quotation.xml.
The t-attf-action is actually only used to recover the order_id and the
token in website_quotation.js.
opw-652874
Closes#9227Fixes#9226
The fields "payment_acquirer_id" and "payment_tx_id" were not set in the quotation
when selecting a payment method in the online quote.
Inspired from function payment_transaction in addons/website_sale/controllers/main.py
opw:652733
Jérome Maes